Analysis
-
max time kernel
194s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 19:16
Static task
static1
Behavioral task
behavioral1
Sample
ca20f4da678ffeb8ee369186a88107c65cb85e8de96b4f1d9c16114a78ae6112.exe
Resource
win7-20221111-en
General
-
Target
ca20f4da678ffeb8ee369186a88107c65cb85e8de96b4f1d9c16114a78ae6112.exe
-
Size
920KB
-
MD5
c83277157445f38c74b8a27f755c55e9
-
SHA1
ec49c8fe151e6f6aa6e237d253327e3de7770173
-
SHA256
ca20f4da678ffeb8ee369186a88107c65cb85e8de96b4f1d9c16114a78ae6112
-
SHA512
d021b8ac83a6a47e1461800e863b431d01edfad9e290fb0f98f5007336f5d499c3bff8b4dea121d4ae2430a5d112219af418ba9ea60c21852bb3c85773f3c7b9
-
SSDEEP
24576:h1OYdaOXMtdHAqcdDVhYwiei7+EpFAh/kKY:h1Os+PHVmVhYwiLtKkKY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
9qFqtv3vEFidCdj.exepid process 2496 9qFqtv3vEFidCdj.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
9qFqtv3vEFidCdj.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjfcniggfldabpkfddjlnnfliaiikhcn\2.0\manifest.json 9qFqtv3vEFidCdj.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjfcniggfldabpkfddjlnnfliaiikhcn\2.0\manifest.json 9qFqtv3vEFidCdj.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjfcniggfldabpkfddjlnnfliaiikhcn\2.0\manifest.json 9qFqtv3vEFidCdj.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjfcniggfldabpkfddjlnnfliaiikhcn\2.0\manifest.json 9qFqtv3vEFidCdj.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjfcniggfldabpkfddjlnnfliaiikhcn\2.0\manifest.json 9qFqtv3vEFidCdj.exe -
Drops file in System32 directory 4 IoCs
Processes:
9qFqtv3vEFidCdj.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 9qFqtv3vEFidCdj.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 9qFqtv3vEFidCdj.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 9qFqtv3vEFidCdj.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 9qFqtv3vEFidCdj.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
9qFqtv3vEFidCdj.exepid process 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe 2496 9qFqtv3vEFidCdj.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
9qFqtv3vEFidCdj.exedescription pid process Token: SeDebugPrivilege 2496 9qFqtv3vEFidCdj.exe Token: SeDebugPrivilege 2496 9qFqtv3vEFidCdj.exe Token: SeDebugPrivilege 2496 9qFqtv3vEFidCdj.exe Token: SeDebugPrivilege 2496 9qFqtv3vEFidCdj.exe Token: SeDebugPrivilege 2496 9qFqtv3vEFidCdj.exe Token: SeDebugPrivilege 2496 9qFqtv3vEFidCdj.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ca20f4da678ffeb8ee369186a88107c65cb85e8de96b4f1d9c16114a78ae6112.exedescription pid process target process PID 1788 wrote to memory of 2496 1788 ca20f4da678ffeb8ee369186a88107c65cb85e8de96b4f1d9c16114a78ae6112.exe 9qFqtv3vEFidCdj.exe PID 1788 wrote to memory of 2496 1788 ca20f4da678ffeb8ee369186a88107c65cb85e8de96b4f1d9c16114a78ae6112.exe 9qFqtv3vEFidCdj.exe PID 1788 wrote to memory of 2496 1788 ca20f4da678ffeb8ee369186a88107c65cb85e8de96b4f1d9c16114a78ae6112.exe 9qFqtv3vEFidCdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca20f4da678ffeb8ee369186a88107c65cb85e8de96b4f1d9c16114a78ae6112.exe"C:\Users\Admin\AppData\Local\Temp\ca20f4da678ffeb8ee369186a88107c65cb85e8de96b4f1d9c16114a78ae6112.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\9qFqtv3vEFidCdj.exe.\9qFqtv3vEFidCdj.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\9qFqtv3vEFidCdj.datFilesize
1KB
MD5c9773fa15f16913d401f2bfa8ba81e42
SHA1555a9b99fe5d36cac112ebbd43353604b8fa1730
SHA256f267041dd34ba732ed473d9a73c250a570007906637e382c12e78f6cf28f424d
SHA51268d2834589aaab34e55cb05985291a5231023ee044b262d2cbdd126a746fcfb4761974e7cf24cd21400592a0036bc290ddea93c92bfe8c06f2d9fe6291b11ef7
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\9qFqtv3vEFidCdj.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\9qFqtv3vEFidCdj.exeFilesize
760KB
MD5dcd148f6f3af3e3b0935c4fcc9f41811
SHA1ee9bdbc7c568c7832d90b85921ab20030b6734cd
SHA256f8689641199c6fc430121797965485d95abfbc430753e0e668817ab3b511a1e4
SHA51234be8e60dc2decf8287a71516f359e80bb858ce52218dde1b01c821c9b95be38821f068b79b0da8dbe90865560e7ddab77b25e3971dda9be667fb3ae8f174886
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\hjfcniggfldabpkfddjlnnfliaiikhcn\RLeBQp5HsX.jsFilesize
6KB
MD5ded68a2c6e743f7581f21c15e06de017
SHA13c35385c82ede31dcbe4ff8a0481f8d4557f24db
SHA256ef24a1b3656480dd5479d2acb0e4fc993962a8c23a257f72b535c845dcb07687
SHA512b81a952cbb87d92b7ee35f04ca15f42d143b41258144fc16c5469c616f510d9a0b758c24cdf70b3e502b13a203797d45f23024a19a910eb1bb028470e1a8a9f0
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\hjfcniggfldabpkfddjlnnfliaiikhcn\background.htmlFilesize
147B
MD5d3773d9b327b4506aa670332a83a5823
SHA16921a637a5e802a7329a6f4c5eac0dc981d6566a
SHA256786c040189030982ae68727048357342040bd4f09d8da6dea7a41f43c292edb3
SHA5127b93105cfc7a5430712de2d88f0df17e3d52287ec42d4ace9f309e34bea392044dc3b712d9ca4ca094b3cbd9a9642114c78724a18d6492675ee53db6863ef242
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\hjfcniggfldabpkfddjlnnfliaiikhcn\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\hjfcniggfldabpkfddjlnnfliaiikhcn\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\hjfcniggfldabpkfddjlnnfliaiikhcn\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\p7P2@M.com\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\p7P2@M.com\chrome.manifestFilesize
35B
MD56ab73129bbce049e13e8fea655181ccd
SHA1a66d346ae4eb2f71193be579f0b59430a93d291c
SHA256be0f98b926bb75c2d2a96c2a3a08e6671363cc3169333974b3abdfcee87b2053
SHA512d28446de47c57abc748fa005d519ddf38d8872a674a1be3fcaf3bbb4cafc7724b1c26e4e0b1be93acdbedd41b0d7cae7c1d7b13af54e4597541bfe553b837bc4
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\p7P2@M.com\content\bg.jsFilesize
9KB
MD5caf9941cea1759d4ea9b87062e7d0e29
SHA179137061c0a0909bb9c1228ef235e642fdcd2069
SHA256e06197e66029a211e22b46525a153a6a0d0a70a1e5935a24365d4cec0a8c2f7d
SHA512a2285af3802a3047cad8fed6ad20198b382b387c1533deb1f53aecb4eeed5577482cdfd2889656a4270b39d66f30f684560ddbec54fb20076a950f9b2f411b28
-
C:\Users\Admin\AppData\Local\Temp\7zS5CF5.tmp\p7P2@M.com\install.rdfFilesize
592B
MD555cb8040b4a9b15fdf7db56dc4d7370b
SHA145dd6d21eef8c262b9b9f6a806459ae61c53ed79
SHA2567d7437217c71d123b12b8bbb796b68231998766bcc2944921e21a39abd999bf4
SHA512597b1ae0924484626ed67c1118a3f1b5e62894a5f7e0199e79ae454ceb7046189c3a26bf09f5ca91a4eaa8078f1e700ff680b2f8d83f4b6e0db111ac288653a0
-
memory/2496-132-0x0000000000000000-mapping.dmp